Experts say a cyberattack ‘can’t be ruled out’ for the Vodafone outage

Hundreds of thousands of Brits were left unable to get online yesterday, as Vodafone experienced one of the biggest blackouts of the year. 

At the peak of the four–hour outage, more than 135,995 users reported issues on DownDetector – with 69 per cent saying they couldn’t use their landline internet.

So, what was behind the outage? 

In a statement this morning, a spokesperson for Vodafone claimed the problems were ‘triggered by a non–malicious software issue with one of our vendor partners’.

In Vodafone’s latest official statement about the incident, the telco blamed a ‘non–malicious software issue’, but didn’t give any further information.

It said: ‘On Monday afternoon, for a short time, the Vodafone network had an issue affecting broadband, 4G and 5G services,’ a Vodafone spokesperson told the Daily Mail. 

‘This was triggered by a non–malicious software issue with one of our vendor partners which has now been resolved, and the network has fully recovered. 

‘We apologise for any inconvenience this caused our customers.’

However,  amid fears the outage was the latest in a string of cyberattacks to hit the UK, experts have warned that such malicious disruptions to phone networks are entirely possible.

‘Something went really quite wrong,’ Professor Alan Woodward, a computer security expert at the University of Surrey, told the Daily Mail. 

According to the academic, phone networks could be vulnerable to a ‘nation state’ cyberattack – where the perpetrators are acting on behalf of their government. 

He told the Daily Mail: ‘National states often hide behind criminals as proxies for deniable plausibility.

‘It was a fairly spectacular outage which is unusual as networks tend not to have single points of failure precisely in case there is a technical fault, so it’s possible it was deliberate.’ 

In the case of Vodafone, he said there may have been some kind of internal issue – a ‘silly little mistake’ by someone with a lot of control behind the scenes, such as a company engineer. 

‘Someone may have done a software upgrade that went horribly wrong and took the whole thing down,’ he said. 

‘We’ve seen large critical organisations brought to a halt by technical failures that theoretically should not have impacted as badly as they did due to human error, such as configuration mistakes, so I still wouldn’t rule that out.’ 

Andy Aitken, co–founder and CEO of mobile virtual network operator Honest Mobile said the outage likely stemmed from a ‘technical fault’. 

‘Given how severe the outage was, it was likely with one of their most important pieces of infrastructure,’ he told the Daily Mail. 

‘If Vodafone have gone on the record to say this was a non–malicious software issue, it’s pretty safe to say it wasn’t a cyber attack.

‘It would be incredibly brazen to deny that and then have to walk it back later.’ 

Mr Aitken said it’s ‘shocking’ how often outages happen with such critical infrastructure. 

‘Outages like this aren’t rare anymore – we’re seeing a couple every year,’ Mr Aitken said. 

‘You’d expect more resilience to be baked in, yet the reality is that telecoms systems aren’t as robust as people assume. 

‘When one critical piece of infrastructure fails badly, it can knock millions of people offline in an instant. 

‘That’s why it’s becoming increasingly important for people to have the flexibility to connect across different networks – so one company’s outage doesn’t bring millions to a standstill.’ 

Dr Manny Niri, senior cyber security lecturer at Oxford Brookes University, said ‘technical faults can look like attacks’.

‘For now, we can take Vodafone’s statement as accurate,’ he told the Daily Mail. 

‘A vital matter now is learning from the incident – big telecom companies rely heavily on software and systems from other companies, and a single problem with a partner can affect millions of customers and critical services.’   

Jake Moore, tech expert and security advisor at ESET, said he doesn’t think it was a cyberattack, although the sudden nature of the outage mirrors a ‘distributed denial–of–service’ (DDoS).

A DDoS is where the attacker floods a server with internet traffic to prevent users from accessing connected online services and sites, like a traffic jam on the internet. 

‘Outages will always naturally raise early suspicions of a potential cyber incident, though current evidence points more towards an internal network failure than a confirmed attack,’ Moore said. 

‘The sudden outage, combined with the inability to access customer service lines, mirrors classic symptoms of a distributed denial–of–service (DDoS) attack, where attackers overwhelm the network so the site or systems collapse.

‘However, malicious or not, this once again highlights our heavy reliance on digital infrastructure, especially in an age where we increasingly depend on mobile networks for everything.

‘Ultimately, resilience is essential, whether the cause is a direct cyberattack, a supply chain issue or a critical internal error.’